Commit 7bf99896 authored by Miklos Szeredi's avatar Miklos Szeredi Committed by Greg Kroah-Hartman

vfs: move permission checking into notify_change() for utimes(NULL)

commit f2b20f6e upstream.

This fixes a bug where the permission was not properly checked in
overlayfs.  The testcase is ltp/utimensat01.

It is also cleaner and safer to do the permission checking in the vfs
helper instead of the caller.

This patch introduces an additional ia_valid flag ATTR_TOUCH (since
touch(1) is the most obvious user of utimes(NULL)) that is passed into
notify_change whenever the conditions for this special permission checking
mode are met.
Reported-by: default avatarAihua Zhang <zhangaihua1@huawei.com>
Signed-off-by: default avatarMiklos Szeredi <mszeredi@redhat.com>
Tested-by: default avatarAihua Zhang <zhangaihua1@huawei.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 6b746940
...@@ -202,6 +202,21 @@ int notify_change(struct dentry * dentry, struct iattr * attr, struct inode **de ...@@ -202,6 +202,21 @@ int notify_change(struct dentry * dentry, struct iattr * attr, struct inode **de
return -EPERM; return -EPERM;
} }
/*
* If utimes(2) and friends are called with times == NULL (or both
* times are UTIME_NOW), then we need to check for write permission
*/
if (ia_valid & ATTR_TOUCH) {
if (IS_IMMUTABLE(inode))
return -EPERM;
if (!inode_owner_or_capable(inode)) {
error = inode_permission(inode, MAY_WRITE);
if (error)
return error;
}
}
if ((ia_valid & ATTR_MODE)) { if ((ia_valid & ATTR_MODE)) {
umode_t amode = attr->ia_mode; umode_t amode = attr->ia_mode;
/* Flag setting protected by i_mutex */ /* Flag setting protected by i_mutex */
......
...@@ -87,21 +87,7 @@ static int utimes_common(struct path *path, struct timespec *times) ...@@ -87,21 +87,7 @@ static int utimes_common(struct path *path, struct timespec *times)
*/ */
newattrs.ia_valid |= ATTR_TIMES_SET; newattrs.ia_valid |= ATTR_TIMES_SET;
} else { } else {
/* newattrs.ia_valid |= ATTR_TOUCH;
* If times is NULL (or both times are UTIME_NOW),
* then we need to check permissions, because
* inode_change_ok() won't do it.
*/
error = -EPERM;
if (IS_IMMUTABLE(inode))
goto mnt_drop_write_and_out;
error = -EACCES;
if (!inode_owner_or_capable(inode)) {
error = inode_permission(inode, MAY_WRITE);
if (error)
goto mnt_drop_write_and_out;
}
} }
retry_deleg: retry_deleg:
inode_lock(inode); inode_lock(inode);
...@@ -113,7 +99,6 @@ static int utimes_common(struct path *path, struct timespec *times) ...@@ -113,7 +99,6 @@ static int utimes_common(struct path *path, struct timespec *times)
goto retry_deleg; goto retry_deleg;
} }
mnt_drop_write_and_out:
mnt_drop_write(path->mnt); mnt_drop_write(path->mnt);
out: out:
return error; return error;
......
...@@ -224,6 +224,7 @@ typedef int (dio_iodone_t)(struct kiocb *iocb, loff_t offset, ...@@ -224,6 +224,7 @@ typedef int (dio_iodone_t)(struct kiocb *iocb, loff_t offset,
#define ATTR_KILL_PRIV (1 << 14) #define ATTR_KILL_PRIV (1 << 14)
#define ATTR_OPEN (1 << 15) /* Truncating from open(O_TRUNC) */ #define ATTR_OPEN (1 << 15) /* Truncating from open(O_TRUNC) */
#define ATTR_TIMES_SET (1 << 16) #define ATTR_TIMES_SET (1 << 16)
#define ATTR_TOUCH (1 << 17)
/* /*
* Whiteout is represented by a char device. The following constants define the * Whiteout is represented by a char device. The following constants define the
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment